Chapter 8 — Security architecture basics

Chapter 8 — Security architecture basics

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Standard clinic"]
  N2["8.2 Layers"]
  N3["8.3 Deviations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Standard clinic"]
  N2["8.2 Layers"]
  N3["8.3 Deviations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Standard clinic]
    |
    v
[8.2 Layers]
    |
    v
[8.3 Deviations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) describe a standard secure clinic design; (2) apply layered protection; (3) record deviations from the standard.

8.1 Standard clinic

Priya helps draft a standard design for Riverton clinics: separate network segments for clinical devices, reception, card terminals and guest Wi-Fi; managed and encrypted computers; individual accounts with multi-factor authentication for cloud services; and offline backups of the image archive. A standard design makes clinics easier to support and audit, because every clinic should look the same and differences stand out. Because every clinic should match, a guest Wi-Fi linked to reception computers in one clinic becomes an obvious exception to fix.

8.2 Layers

Priya applies layered protection to ransomware. Email filtering blocks many attacks. Multi-factor authentication stops stolen passwords being reused. Device controls limit unknown software. Network segments limit spread from reception to imaging. Offline backups allow recovery. She learns that each layer catches some of what the others miss, and that a clinic with all layers is far more resilient than one relying on a single strong control. Network segments between reception and imaging matter most when email filtering and authentication have already been bypassed.

8.3 Deviations

Two clinics in old buildings cannot install separate network cabling soon. Priya records each deviation in a register: what differs, why, the risk and compensating measures, such as wireless segmentation, plus a date for review. She learns that recording deviations keeps them visible and managed. Without a register, exceptions spread quietly until the standard exists only on paper, which auditors quickly discover. Wireless segmentation in the two old buildings, for example, gives partial separation until cabling can be installed. Each review date forces a decision on whether cabling can now be installed.

Worked example

Priya drafts a standard clinic design with four segments, layers ransomware defences and records two building-related deviations.

Synthetic case. The design is synthetic.

Errors and limits

Standards lag new devices. Compensating measures may be weaker.

Exercises

• EX022 — Four segments. Which four network segments does the standard define? Rubric: 3 = clinical devices, reception, card terminals, guest Wi-Fi;; 2 = four;; 1 = vague;; 0 = none.
• EX023 — Standard benefit. Why does a standard design help audits? Rubric: 3 = differences between clinics stand out;; 2 = consistency;; 1 = vague;; 0 = none.
• EX024 — Deviation record. What does each deviation record include? Rubric: 3 = difference, reason, risk, compensating measures and review date;; 2 = record;; 1 = vague;; 0 = none.

Synthesis

Standard designs with layered protection and a deviation register keep multi-site security consistent.

Continue studying — chapter 08 of 30

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →